Failed join, non-default SSH Port

Apps & App Center
1

I don’t know if it’s an OpenProject specific error or a general UCS problem. The join of OpenProject doesn’t work with a different SSH port than the default 22 port.
I had to change the port to 22 again to install OpenProject.

I changed the SSH Port using:

# close SSH port 22 
ucr unset	security/packetfilter/package/univention-base-files/tcp/22/all
ucr unset	security/packetfilter/package/univention-base-files/tcp/22/all/en

# open new port 3232
ucr set security/packetfilter/package/univention-base-files/tcp/3232/all=ACCEPT
ucr set security/packetfilter/package/univention-base-files/tcp/3232/all/en=SSH

# change ssh Port to 3232
ucr set sshd/port=3232

Do I have to set some other variable, so that the join script knows the new SSH port?

2

In general, don’t do that. Several processes in Univention require ssh access to the various servers. Sure, you can try to work around that with entries in the various ssh_config files, but that won’t work well with Docker-based apps as each time the image is updated your modification is lost.

If you’re changing the ssh port out of security considerations, I highly suggest you use other methods:

  • adjusting the firewall to only allow access from private or known good IP addresses
  • deploy fail2ban/sshguard in order to block brute-force attempts
  • use Match blocks inside /etc/ssh/sshd_config in order to apply different settings to different IP addresses, e.g. prevent root logins in general but allow them from private IP address spaces
1 Like